TLDR; * Security is definitely an additional overhead for DevOps practices. Self-Serve tooling helps ease the gap between Engineering and Security. * Some of the best practices of DevOps are: Do not embed secrets in Code. Follow Standardization via Config Management, automation (IaC) and Observability. * It’s highly recommended to use
June 16, 2023
TLDR; * For an organization starting to incorporate Security into their systems, start right (as in securing your Production Systems) and make progress towards securing the Source Code. This helps bridge the gap between best case scenario and current state. * Security is not always the highest priority. Depending on the stage
June 09, 2023
TLDR; * Threat Modeling is a continuous activity and should be part of every phase of SDLC starting from Design phase itself. * For Threat Modeling, start with something as simple as STRIDE framework and as the organization matures, review and utilize other frameworks as needed. * For resource constrained organizations, start with
June 06, 2023